IndexSizeError is thrown on undo when Enter_BR is used

[Jakub Ś]

Problem can be reproduced in Firefox and IE9-10. To reproduce:

1. Open the “Replace textarea elements by class name” sample page.
2. Put the cursor in the editor content.
3. Control-A to select all text and then DELETE.
4. Paste in some unformatted text 3 times (I typed "this pasted in" in notepad and copied it to the clipboard).
5. Enter carriage return.
6. Paste the text in 3 more times.
7. Click undo two times.

JS error is thrown: Message: IndexSizeError: Index or size is negative or greater than the allowed amount
Line: 1942
URI: ckeditor4/core/selection.js
Code: nativeRange.setStart( range.startContainer.$, range.startOffset );